IN THE CLAIMS 

Please amend the claims to read as follows: 
Listing of Claims 

1. (Currently Amended) A network monitoring system that monitors communication 
between a client and server, the network monitoring system comprising: 

a data acquisition section that acquires a plurality of packets flown on a network; 

a data analysis section that acquires action explanation information from the plurality of 
packets acquired by the data acquisition section; 

a display-information generation section that generates information of each individual 
action occurring on the network on the basis of the action explanation information acquired by 
the data analysis section; and 

a display unit that displays the information generated by the display-information 
generation section, wherein: 

in response to a request by a user, the display-information generation section regenerates, 
for continuous play back, information of a sequence of individual actions that occurred on the 
network and cooperates with the display unit to display, during each play back, the regenerated 
information of each individual action of the sequence at the same time interval within the 
sequence as the action occurred, and 

action explanation information for explaining each individual action is acquired from a 
plurality of packets , and 
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the information displayed by the display unit includes the type of operating system 
employed by the client, the type of operating system employed by the server, an account name of 
a user accessing the client, and an icon representing the account name . 

2. (Original) The network monitoring system according to claim 1, wherein the action 
explanation information is defined in advance. 

3. (Original) The network monitoring system according to claim 1, wherein the data 
analysis section identifies kinds of the packets acquired by the data acquisition section and 
acquires the action explanation information from the packets on the basis of the identified kinds 
of the packets. 

4. (Previously Presented) The network monitoring system according to claim 1, wherein 
the action explanation information includes: 

sending source computer information and destination computer information included in a 
connection packet; 

user information included in an authentication packet; 

action object information included in an object specification packet; 

action information included in a command packet; and 

data included in a data packet. 
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5. (Previously Presented) The network monitoring system according to claim 1, further 
comprising: 

an analysis data storage section that stores the action explanation information acquired by 
the data analysis section, wherein: 

the display-information generation section regenerates the information of the sequence of 
individual actions that occurred on the network from the action explanation information stored 
by the analysis data storage section. 

6. (Previously Presented) The network monitoring system according to claim 5, wherein: 
the action explanation information stored by the analysis data storage section includes 

time information, which corresponds to the time at which the single action occurred; and 
the display-information generation section determines the time interval, within the 
sequence, that each individual action occurred using the time information stored by the analysis 
data storage section. 

7. (Previously Presented) The network monitoring system according to claim 5, wherein 
the display-information generation section continuously regenerates the sequence after each 
predetermined period, which period is accurate within 500 milliseconds. 

8. (Previously Presented) The network monitoring system according to claim 1, wherein 
the display-information generation section extracts and generates the information of each action 
occurring on the network in accordance with a display setting set by a user. 
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9. (Currently Amended) A network monitoring method for monitoring communication 
between a client and server, the method comprising: 

acquiring a plurality of packets flown on a network; 

acquiring action explanation information from the plurality of acquired packets; 

generating information of each individual action occurring on the network on the basis of 
the acquired action explanation information; 

regenerating for continuous play back, in response to a request by a user, information of a 
sequence of individual actions that occurred on the network; and 

displaying on a display unit, during each play back, the regenerated information of each 
individual action of the sequence at the same time interval within the sequence as the action 
occurred, wherein; 

action explanation information for explaining each individual action is acquired from a 
plurality of packets , and 

the information displayed on the display unit includes the type of operating system 
employed by the client, the type of operating system employed by the server, an account name of 
a user accessing the client, and an icon representing the account name . 

10. (Original) The network monitoring method according to claim 9, wherein the action 
explanation information is defined in advance. 
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11. (Original) The network monitoring method according to claim 9, wherein in the 
acquisition of the action explanation information, kinds of the packets acquired by the packet 
acquisition are identified and the action explanation information is acquired from the packets on 
the basis of the identified kinds of the packets. 

12. (Previously Presented) The network monitoring method according to claim 9, 
wherein the action explanation information includes: 

sending source computer information and destination computer information included in a 
connection packet; 

user information included in an authentication packet; 

action object information included in an object specification packet; 

action information included in a command packet; and 

data included in a data packet. 

13. (Previously Presented) The network monitoring method according to claim 9, further 
comprising: 

storing the acquired action explanation information, wherein: 

the information of the sequence of individual actions that occurred on the network is 
regenerated from the stored action explanation information. 

14. (Previously Presented) The network monitoring method according to claim 13, 
wherein: 
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the stored action explanation information includes time information, which corresponds 
to the time at which the single action occurred; and 

the time interval, within the sequence, that each individual action occurred is determined 
using the stored time information. 

15. (Previously Presented) The network monitoring method according to claim 13, 
further comprising continuously regenerating the sequence after each predetermined period, 
which period is accurate within 500 milliseconds. 

16. (Previously Presented) The network monitoring method according to claim 9, 
wherein the information of each action occurring on the network is extracted and generated in 
accordance with a display setting set by a user. 

17. (Currently Amended) A network monitoring program recorded on a computer 
readable medium and executable by a computer, the program making the computer monitor 
communication between a client and server and perform a process comprising: 

acquiring a plurality of packets flown on a network; 

acquiring action explanation information from the plurality of acquired packets; 

generating information of each individual action occurring on the network on the basis of 
the acquired action explanation information; 

regenerating for continuous play back, in response to a request by a user, information of a 
sequence of individual actions that occurred on the network; and 
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displaying on a display unit, during each play back, the regenerated information of each 
individual action of the sequence at the same time interval within the sequence as the action 
occurred, wherein 

action explanation information for explaining each individual action is acquired from a 
plurality of packets , and 

the information displayed on the display unit includes the type of operating system 
employed by the client, the type of operating system employed by the server, an account name of 
a user accessing the client, and an icon representing the account name . 

18. (Original) The network monitoring program according to claim 17, wherein the 
action explanation information is defined in advance. 

19. (Original) The network monitoring program according to claim 17, wherein in the 
acquisition of the action explanation information, kinds of the packets acquired by the packet 
acquisition are identified and the action explanation information is acquired from the packets on 
the basis of the identified kinds of the packets. 

20. (Previously Presented) The network monitoring program according to claim 17, 
wherein the action explanation information includes: 

sending source computer information and destination computer information included in a 
connection packet; 

user information included in an authentication packet; 
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action object information included in an object specification packet; 
action information included in a command packet; and 
data included in a data packet. 

21. (Previously Presented) The network monitoring program according to claim 17, 
wherein: 

the process further comprises storing the acquired action explanation information; and 
the information of the sequence of individual actions that occurred on the network is 
regenerated from the stored action explanation information. 

22. (Previously Presented) The network monitoring program according to claim 21, 
wherein: 

the stored action explanation information includes time information, which corresponds 
to the time at which the single action occurred; and 

the time interval, within the sequence, that each individual action occurred is determined 
using the stored time information. 

23. (Previously Presented) The network monitoring program according to claim 21, 
wherein the process further comprises continuously regenerating the sequence after each 
predetermined period, which period is accurate within 500 milliseconds. 
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24. (Previously Presented) The network monitoring program according to claim 17, 
wherein the information of each action occurring on the network is extracted and generated in 
accordance with a display setting set by a user. 

25. (New) The network monitoring system of claim 1, wherein the display unit displays 
a graphical representation of the communication connection between the client and the server. 

26. (New) The network monitoring method of claim 9, wherein the display unit displays 
a graphical representation of the communication connection between the client and the server. 

27. (New) The network monitoring program of claim 17, wherein the display unit 
displays a graphical representation of the communication connection between the client and the 
server. 
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